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Abstract 

In some cases, the original signer may delegate its signing power to a 
specified proxy group while ensuring individual accountability of each par- 
ticipant signer. The proxy signature scheme that achieves such purpose 
is called the multi-proxy signature scheme and the signature generated 
by the specified proxy group is called multi-proxy signature for the orig- 
inal signer. Recently such scheme has been discussed by Lin et al. Lins 
scheme is based on partial delegation by Mambo et al. In present chap- 
ter we introduce a new multi-proxy signature scheme, which requires less 
computational overhead in comparison to Lin et al, and also fulfill the 
requirement of partial delegation with warrant simultaneously. 

1 Introduction 

Mambo et al introduced a proxy signature scheme in which an original signer 
delegates his signing power to another signer called the proxy signer. They 
also proposed three proxy signature schemes for partial delegation based on 
ElGamals, Okamotos and Schnorrs scheme. Since then several proxy-signature 
schemes have been developed [?, ?, ?, ?, ?, ?, ?] . One well-known variation of the 
proxy signature scheme by Kim et al includes a warrant in the proxy signature. 
The warrant is a message, which includes information of the messages types that 
are delegated and proxy signers identity that prevent the transfer of proxy power 
to another party. Another variation, viz, threshold proxy signature scheme was 
proposed in [?] in which original signer delegates its signing power to a set of n 
proxy signers in such a way that any t out of these n proxy signers may produce 
a valid proxy signature. 
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multi-proxy signature scheme, which requires less computational overhead in 
comparison to Lin et al, and also fulfills the requirement of partial delegation 
with warrant simultaneously. Our scheme is based on Kim et als scheme. For 
ordinary signing operation we use Schnorrs scheme. 

The rest of the chapter is summarized thus: In section [21 we give review 
of literature. In section [31 Kims scheme is discussed. Section ?? contains the 
proposed scheme. Section [B] contains proofs for correct ness of the scheme and 
in section[S]we discuss performance. Finally, Section concludes the discussion. 

2 Related Previous Works 

Mambo et al. [?] developed a systematic approach to proxy or delegated signa- 
tures. After the introducing the proxy problem they firstly divide the delegation 
in three kinds, which was further extended by Kim et al [?] by adding one more 
kind partial delegation by warrant. Till now we have the following four types 
of delegations discussed in previous chapters. 

Yi et al, in 2000, proposed proxy multisignature scheme which allows a group 
of original signers to delegate its signing power to a single proxy signer. Proxy 
signer can sign any message on behalf of whole group. Further, Hwang et al, in 
2001, introduced a new proxy multi-signature scheme. 

On the other hand Lee et als scheme states a multi proxy signature scheme 
which fulfills similar criteria discussed as before. This scheme also allows a 
group of original signers to delegate its signing capability to a single proxy 
signer. We feel the nomenclature used by Lee et al is not proper. To remove 
this ambiguity we define these terms: multi proxy signature and proxy multi 
signature as follows: 

Definition l.An original signer delegates its signing power to the 
specified proxy group while ensuring individual accountability of each 
participant signer. The proxy signature that is generated by such a 
specified proxy group, we call, multi proxy signature. 

Definition 2. A specified original signers group delegate the groups 
signing power to a single proxy signer. The proxy signature that is 
generated by such a proxy signer, we call, proxy multi- signature. 

3 Kim's Scheme for Partial Delegation [?] 

Before introducing our proposed scheme it is necessary to introduce Kim et als 
scheme. Here p denotes a large prime with 2 511 < p < 2512 and g denotes a 
generator for Z* . Each user selects a secret key x u G Z* and computes a public 
key y u — g Xu mod p. The system parameters are - 
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• p : A large prime number 

• q : A prime factor of (p — 1) 

• g : Element of Z* of order q 

• x u : Secret key of the original signer S, here x u E Z q 

• y u : Public key of the original signer S, such that y u — g Xu mod p 
Basic protocol consists of the following: 

3.0.1 Proxy Generation 

1. (Key Generation)- An original signer selects a random number k E Z q ,k ^ 
1 and computes 

r = g h mod p and e = h(m w ,r) 

where m w is warrant message having the information about delegation 
and h is publicly known hash function. Now he/she computes the proxy 
signature key s = xe + k mod q 

2. (Proxy Key Delivery)- The original signer sends (m w ,s,r) to a proxy 
signer in a secure way. 

3. (Key verification)- After receiving the secret key (m w ,s,r) the proxy 
signer computes e = h(m w ,r) and checks the validity of the key with 
the following equation 

g s = y e r mod p 

If this congruence passes, he/she accepts it as secret key otherwise rejects 
it and request another one, or simply stops the protocol. 

3.0.2 Proxy Signing 

When the proxy signer signs a message m on behalf of the original signer, he 
computes a signature s p using any original signature scheme and s as the secret 
key. Then the pair (m, m w , s p , r) is the proxy signature, 

3.0.3 Verification 

The verification of the proxy signature is carried out by same checking operation 
as in original signature scheme except for extra computation 

e = h(m w , r) and y = y e r mod p 

The value y' may be dealt with as a new public key, which shows the involvement 
of Alice. 
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4 Proposed Scheme 



4.0.4 System Setup 

Choose two large primes p and q such that q\(p — 1), a generator g e Z* with 
order q. h{.) is a one way hash function. The original signer O has its private 
ket as x € Z q and public yo where yo = g x " mod p. P = {Pi,P 2 , P n } is the 
set of the delegated signers. Then each Pi has its private key Xi and public key 
yi where yt — g Xi mod p. 

4.0.5 Proxy Generation 

1. (Key Generation)- The original signer selects n random numbers hi G 
Z q , ki ^ 1 (for i = 1, 2, n) and computes a commitment 

n = g ki mod p and e = h(m w ,r) 

where to w is warrant message having the information about delegation 
and r = Hri mod p. Now he/she computes the proxy signature key 

a = xr + k mod q 

2. (Proxy Key Delivery)- The original signer sends (a, r) to a proxy signer 
in a secure way and makes m w public. 

3. (Key verification)- After receiving the tuple (m w ,s,r) the proxy signer 
computes m w = g^^y^r mod p and checks the m w . If this holds, he/she 
accepts it as secret key otherwise rejects it and request another one, or 
simply stops the protocol. 

4.0.6 Proxy Signing 

When the proxy signer signs a message m on behalf of the original signer, he 
computes a signature s p using any original signature scheme and s as the secret 
key. Then the pair (m, m w , s p , r) is the proxy signature, 

4.0.7 Verification 

The verification of the proxy signature is carried out by same checking operation 
as in original signature scheme except for extra computation 

e = h{m w , r) and y' = y e r mod p 

The value y' may be dealt with as a new public key, which shows the involvement 
of Alice. 
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Table 1: Lin ct als scheme 



Phases 


Computational Load 


Proxy generation with verification 


(n + 3)E + (2n)M + H 


Multi proxy signature generation 
(including proxy verification) 


(2n + 2)E + {n A + 2n)M + (n + 1)H 


Multi-signature verification 


2E + M + H 



Table 2: Our Scheme 



Phases 


Computational Load 


Proxy generation with verification 


(n + A)E + (2n + 4)M + 21 


Multi proxy signature generation 
(including proxy verification) 


(5n + 2)E + (4n + 4)M + 2H 


Multi-signature verification 


3E + 3M + H 



5 Performance 

Let E, M and I respectively denote the computational load for exponentiation, 
multiplication and inversion. Then following table shows the computational 
load of our scheme. Each phase in our scheme has less computational load than 
Lin et als scheme. In our scheme computational load in verification phase is 2E 
+ M + H, whereas in Lin et als scheme it is 3E + 3M +H. In some applications 
digital information is signed once but verified more than once. In such situation 
the efficiency of our scheme increases with the number of times verification is 
done. Security of scheme is inherited from original scheme used. Further the 
total computation cost in our scheme is less than other existing schemes. Thus, 
our scheme has computational advantage over other schemes. 

6 Correctness of the Scheme 



7 Conclusion 

In present paper we introduced a new multi-proxy signature scheme, which 
requires less computational overhead in comparison to Lin et al, and also fulfill 
the requirement of partial delegation with warrant simultaneously. Our scheme 
is based on Kim et als scheme. We also reviewed the ambiguity in nomenclature 
of multi proxy signature and proxy multi signature, and redefine these both 
signatures on the basis of literature in existence. 
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